EU Data Privacy Policy

Last updated: February 1st, 2024

Table of Contents

  1. What Are The Most Important Things to Know (Short Summary)?
  2. What Is This Policy About?
  3. What Does the App Do?
  4. Who Manages My Data and How Can I Contact You?
  5. What Happens to My Data in the App?
  6. What Happens When I Back Up My Data?
  7. What About Paid Services?
  8. How Do You Use My Feedback?
  9. Are You Tracking Me?
  10. What About Ads in the App?
  11. Which Device Permissions Does the App Require?
  12. What Else Should I Know?
  13. What Are My Rights Under the GDPR?

1.What Are The Most Important Things to Know (Short Summary)?

2.What Is This Policy About?

This EU Data Privacy Policy tells you, as a user of our 'myPeriods' app (“App”), how we handle your personal data. We also explain your rights under the EU General Data Protection Regulation (“GDPR”).

3.What Does the App Do?

The App offers these main features (for more details, check the app store description):

4.Who Manages My Data and How Can I Contact You?

We, the app developer team named “BiOM Software” (hereinafter “BiOM Team”, "We" or "Us"), are responsible for the processing of your data:
BiOM Software
[email protected]

5.What Happens to My Data in the App?

You can actively enter the following type of data (“Your Data”):

All Your Data is optional. You don't have to enter it to use the App. But, without Setup Data, key features like the period and cycle calendar won't work. You don't need to provide your name or email.

Your Data is stored only on your device. We can't access it unless you choose to back it up to Google cloud (see section 6).

We use Your Data to make the features available to you, in particular:

The legal basis we use Your Data is to fulfill our contract with you (as per Art. 6 (1) b GDPR) according to our terms and conditons.

Your Data stays on your device until you uninstall the App.You can delete Your Activity Data anytime using the “Delete all data” feature in the App.

6.What Happens When I Back Up My Data?

If your device is lost or destroyed, all Your Data is gone. That's why we develop this back up feature. The backup data is encrypted and can only be decrypted by our App.

You have two options for backup:

Personal Storage Backup (MORE RECOMMENDED):
You can back up Your Data to your personal data storages, like an external device or third-party cloud services (e.g., iCloud). This backup only happens when you choose to do it. We don't have access to these storages, so you stay anonymous.

Our Backup Service with Google:
Alternatively, you can use our backup service which utilizes Google's services. For this, you need to provide an identifier like your Google, Apple, or another email address. This might make you identifiable. With this method, Your Data is continuously backed up, so you don't risk losing any data. We have access to your email and Your Data in the Google backup, but we only use it for the backup service. Your email is an identifier at Google, and we won't use it to contact you. Since Your Data is encrypted before being backed up, Google can't access it in clear.

Please note, Your Data may include health-related information (like moods, medicine, or symptoms). Under the GDPR, we need your consent for backing up this data to Google, and you must be at least 16 years old. Before using the Google backup service, we'll ask you to confirm your age and consent to the backup of health-related data. You can withdraw your consent any time by deleting your Google backup or contacting us (see section 4). Without your consent, you can't use the Google backup service, but you can still back up Your Data to your personal storage.

Your Data will be stored in the Google backup until you uninstall the App or manually delete your backup using the “Delete all account” feature in our App.

The legal basis for handling Your Data in connection with the Google backup is the performance of the contract (Art. 6 (1) b GDPR), and regarding health-related data, your consent (Art. 6 (1) a, Art. 9 (2) a GDPR).

7.What About Paid Services?

If you choose to use paid services in the App, you'll get extra features, like removing ads and accessing additional content.

For payment processing, we share certain types of data with payment processors like Google or Apple, depending on the service you use. This includes the item ID, details about the purchased product/subscription, the paid amount, and the purchase status. We don't receive personal data from Google or Apple that could identify you, and we won't link your payment data with Your Activity Data. We also don't store or collect your payment card details. This information goes directly to our payment processors, and their use of your information is governed by their privacy policies (refer to Google's privacy policy at https://policies.google.com/privacy and Apple's policy at https://support.apple.com/en-sg/101554).

We keep payment data as long as necessary for fulfilling the contract and to comply with legal data retention requirements, Art. 6 (1) a, c GDPR.

8.How Do You Use My Feedback?

You can give us feedback either within the App or by email. When you provide feedback through the App, we don't transfer or access any data that could identify you, just the text of your feedback.

However, if you send us feedback via email, we include some non-personal device data along with it. This data includes the theme type, App version, system version, screen size, language, country, App language, device type, notification access, time zone, network type, Apple Watch connection, account ID, and your subscription status or ad removal status. You can see all this information at the bottom of the email you send us.

We use your feedback to improve our App and services. We keep it only as long as needed for this purpose, which is usually about one month. After that, we delete it.

9.Are You Tracking Me?

No, we don't track you personally.

Please note that we do NOT collect any identifiable information about you. However, we use Google Analytics to improve our service, and we do receive aggregated statistics about our user base from Google. These statistics include information like the number of users and sessions, session durations, operating systems, device models, first launches, App opens, App updates, in-App purchases, approximate geography (around city level), age groups, languages, and gender percentages of our total user base. Google create and provide these statistics to us.

Additionally, we collect some operational information when you use our App. This includes data like button clicks, page views, and timestamps. We use this information to offer you personalized content and to improve our App. This includes considering general settings you make (such as your preferred language) and tracking the time and duration of your activities in our Service. This helps us enhance features that might be getting less attention from you. The legal basis for this data collection is our interest in improving our App (Art. 6 (1) f GDPR) and providing tailored content (Art. 6 (1) b GDPR). We delete this data after two months.

We don't access advertising IDs or app instance identifiers in this process.

10.What About Ads in the App?

We use Google's AdMob service to show personalized ads in our App.

Google collects some personal data, like online identifiers and IP addresses, for advertising, analytics, and fraud prevention. Google accesses your information only to carry out these tasks and is bound not to disclose or use it for any other purpose. We don't share Your Activity Data with any third parties for tracking or marketing.

Google will ask for your consent before collecting, using, or sharing your personal data/identifiable information (such as your IP address or identifier). If you choose not to share your personal data with Google, they won't use it for personalized ads.

You have the option to opt out of personalized ads. You can do this in the settings of our App or by following the instructions below. However, please note that you may still see ads even if you opt out, but they will be less relevant.

To understand how Google AdMob collects, uses, and shares your data, please visit: Google AdMob Privacy.

To opt out of AdMob by Google service, follow these instructions: Opting Out of Google Ads.

Google operates as an independent data controller for AdMob services.

For more details on how Google uses collected data, visit "How Google uses data when you use our partners' sites or apps" at Google Partner Sites Policy or Google's Privacy Policy at Google Privacy Policy.

11.Which Device Permissions Does the App Require?

The App will ask for specific permissions, depending on whether you're using an Apple or Google (Android) device.

On Apple iOS devices:

Permission Requested upon Required Use Purpose
Camera - Change profile picture
- Send feedback email
- Add ovulation strips
No - Set profile picture
- Take photos in feedback
- Identify the ovulation strips
Media File Storage - Change profile picture
- Send feedback email
- Add ovulation strips
No - Set profile picture
- Take photos in feedback
- Identify the ovulation strips
Face ID Verify the passport No Facial recognition to verify the passport
Apple Health - Setting
- Input data
No Sync data to Apple Kit
User Tracking Start the app No Personalized ads

On Google Android devices:

Permission Requested upon Required Use Purpose
Storage Open the local backup data No Read the local backup data and restore
Notification Obtained by default No Remind You
Vibrator Obtained by default No Remind You in notification
Ignore battery optimization You click the “Can’t receive reminders?” No Resolve the issue of missing reminders
Auto-start You click the “Can’t receive reminders?” No Resolve the issue of missing reminders
Fingerprint Obtained by default No Unlock the App
Alarm Obtained by default No Remind You

12.What Else Should I Know?

12.1.Access Protection

We recommend using a PIN code, Face ID, or Fingerprint to secure access to the App on your device. We don't have access to your fingerprint or face data when you use these security methods, as they are part of your device's operating system.

12.2.General Information

If you're using our App to collect data about others (like your daughter), you must inform them about this privacy policy and get their consent beforehand.

For any aspects not specifically covered in this EU Data Privacy Policy, the general rule is that all information you provide is voluntary and the legal basis for processing this information is to fulfill the contract between you and us.

12.3.Data Recipients

When we mention Google, we are referring to Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The United States does not offer the same level of data protection as the EU. However, under the EU Commission's adequacy decision (which can be viewed at EU Commission Decision), US companies certified under the EU-US Data Privacy Framework are considered to provide adequate protection for personal data. Google LLC is certified under this framework (EU-US Data Privacy Framework List).

We may use push notifications in the mobile app to communicate with you about updates or information related to the App's functionality, products, services, including necessary security updates.

In the event of a business transfer, we may share or transfer your information during negotiations, or as part of any merger, sale of assets, financing, or acquisition of all or part of our business by another company, to the extend allowed under the GDPR. Before any business transfer, we will give you a 2-week notice about the proposed transfer, details of the transferee company, and the different privacy policy you will be subject to. You will have at least two weeks to decide whether to keep your account or delete it and all associated data before the transfer is completed. The legal basis for this transfer is our interest in preparing and conducting the business transfer, Art. 6 (1) f GDPR.

We may also share information with law enforcement agencies, public authorities, or other organizations if legally required or if such use is necessary and if permissible under GDPR. We will carefully review all such requests to ensure they have a legitimate basis and are limited to data that law enforcement is authorized to access for specific investigative purposes. The legal basis for this transfer is compliance with laws, Art. 6 (1) c and f GDPR.

12.4.Children Privacy

Our App is not designed for children under 16 years old. We do not knowingly collect personal data from anyone under 16. If you're a parent or guardian and become aware that your child has provided us with personal data, please contact us. If we find out that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information from our servers.

12.5.Changes to This Privacy Policy

We may update our Privacy Policy occasionally. When we do, we will inform you by posting the updated policy on this page and by a prominent announcement on our service before the change becomes effective. The "Last Updated" date at the top of this Privacy Policy will also be revised. We recommend you review this Privacy Policy periodically for any changes. Changes are effective once they are posted on this page.

13.What Are My Rights Under the GDPR?

The GDPR grants you specific rights regarding your personal data, which we explain below:

13.1.Data Access

You can ask us to confirm if we're processing your personal data. If we are, you have the right to access that data and to receive detailed information as outlined in Article 15 of the GDPR.

13.2.Correction

You can request that we correct any inaccurate personal data about you promptly. You also have the right to have incomplete personal data completed, according to Article 16 of the GDPR.

13.3.Deletion

You have the right to ask us to delete your personal data immediately under certain conditions, such as if the data is no longer needed for its original purpose, as specified in Article 17 of the GDPR..

13.4.Restriction of processing

You have the right to request a restriction on processing your data if certain conditions apply, for example, if you have contested the accuracy of the data, as per Article 18 of the GDPR.

13.5.Data portability

Under certain conditions, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller without hindrance from us, as mentioned in Article 20 of the GDPR.

13.6.Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes the GDPR. This can be done in your residence, workplace, or the place of the alleged infringement. Supervisory authorities' contact details can be found at here.

13.7.Withdrawal of Consents

If you have provided consent for the processing of your data, you have the right to withdraw this consent at any time, with future effect.

13.8.Objection

You also have a right of objection, which we will point out to you separately below:

Right of objection according to Art. 21 GDPR

You have the right to object to how we process your personal data if it's based on specific grounds outlined in Article 6(1) e or f of the GDPR. This means if the processing is for the public interest or in pursuit of our legitimate interests, you can challenge this processing due to your unique situation. If you object, we will stop processing your data unless we can show strong, legitimate reasons for the processing that outweigh your rights, or if the processing is necessary for legal claims.

Additionally, if we use your personal data for direct marketing (like email advertising), you have the right to object at any time. This objection also covers profiling, as long as it's related to direct marketing. Profiling involves analyzing or predicting personal preferences or interests.